Getting To Know MED-V In Windows 7

This white paper introduces MED-V (Microsoft Enterprise Desktop Virtualization), Microsoft's enterprise-oriented tool for delivering legacy applications in virtual machines running on clients across your business network. The author discusses topics such as whether you need MED-V and how to get it, requirements, core features, and implementing and managing MED-V.

Through a free download, Microsoft offers "Windows XP Mode" for Windows 7: essentially a virtual machine running Windows XP. Windows XP Mode (the subject of a separate Global Knowledge white paper, Windows 7 and "Windows XP Mode") is useful for running older applications and hardware devices that do not work properly under the native Windows 7 operating system but that the organization deems necessary, or at least highly desirable. Windows XP Mode lets such applications and devices run in their expected and accustomed operating system, side-by-side with native Windows 7 applications. That, in turn, lets IT planners move to Windows 7 more quickly than they might otherwise be able to.

While Windows XP Mode is fine for business users (it's not supported on Windows 7 Home editions) who have occasional needs to run a legacy OS in a virtual machine, it's not exactly a "managed" solution. For example, IT administrators don't have a Windows XP Mode management console, so there's no convenient way to deploy, update, restrict, control, or report on virtual machines. For example, if you want to disable Windows XP Mode for certain users, your only tool is the sledgehammer approach of using AppLocker to forbid running Virtual PC (vmwindow.exe) entirely.

This white paper introduces MED-V (Microsoft Enterprise Desktop Virtualization), Microsoft's enterprise-oriented tool for delivering legacy applications in virtual machines running on clients across your business network. You could think of MED-V as the administration layer missing from Windows XP Mode. This product has its origins in the Kidaro Managed Workspace software that Microsoft acquired when it bought Kidaro in 2007. The areas discussed here include the following.

Do You Need MED-V?
How Can You Get MED-V?
Requirements
Core Features
Implementing MED-V
Managing MED-V
Challenges of MED-V

Please note that MED-V's current version is 1.0 SP1 at the time of writing.

MED-V is all about getting incompatible applications to work with a new operating system. The first point to make is that using a virtual machine - be it with Virtual PC, MED-V, or any other technology - to run legacy software is just about always less desirable than modifying or updating the software to run under the native operating system.

So, before turning to MED-V, it's wise to spend time trying other ways to get your apps to run under your OS of choice: haranguing the vendor to provide updates, tweaking the EXE's compatibility settings, and/or spending some quality time with the (free) Microsoft Application Compatibility Toolkit (ACT). (If you need to run legacy hardware - such as the perfectly functional Kodak digital camera I'd been using for years until the manufacturer decided to drop driver support, a common lament these days - then your non-virtualization options may well be more limited.)

If:

Your company is small, or
The number of users needing virtualization of a legacy OS is small, or
Your only incompatible applications are few in number - and
Your desktops are running Windows 7

then you may be content with Windows XP Mode. Bear in mind that it requires hardware-assisted virtualization (Intel VT or AMD-V), although that shouldn't be too much of an issue with modern hardware. It also requires Windows 7; Windows XP Mode isn't available for Vista, because Vista doesn't support Virtual PC. So if you have Vista desktops, you'll want MED-V.

Once you get past a certain size, however, managing two (or more) operating systems simultaneously may put added strain on users and support staff alike. Those virtual XP machines need patching, antivirus, antimalware, etc., just like any workstation OS. You may need to update those VMs periodically. And if you give users the ability to customize or design their own VMs, some will be successful, some will have trouble, and consistency across the network can suffer.

So these are some of the things to think about when deciding about MED-V. Finally, you may also wish to consider the approach of having users remote in to centrally hosted virtual machines, instead of running VMs on their own local workstations. Microsoft dubs this approach VDI, for Virtual Desktop Infrastructure, and it's built around Hyper-V and Terminal Services (oops, I mean Remote Desktop Services). Server-based virtualization is architecturally very different from client-based virtualization, but both can help organizations overcome legacy application compatibility concerns.

View the original article here

Windows 7 Troubleshooting Tips

Your company has finally migrated to Windows 7. Congratulations! And now you have your first support call. This Microsoft white paper will tell you all you need to know about the new troubleshooting tools that are bundled with Windows 7 and provide you with the knowledge to quickly figure out what's happening "under the hood" on a Windows 7 computer. The selected tools described in this Microsoft white paper are a subset of the tools available on Windows 7; the focus is on timely troubleshooting of the operating system and software applications.

The tools selected for this white paper are a subset of the tools available on Windows 7, but the focus is on timely troubleshooting of the operating system and software applications. The tools are in two sections: the first part deals with system troubleshooting tools and the latter part with application troubleshooting tools. Boot-up a Windows 7 computer and test out each tool to become an expert in Windows troubleshooting. Tips are listed in bold typeface throughout the white paper, with the following explanation in italics.

Tip: The first place to start looking for answers on a Windows 7 computer is by opening the Action Center. The Action Center is the central portal for all everything good and bad that happens on a Windows 7 computer system.

Looking on the taskbar, to the left of the clock, you'll see a white flag, (possibly marked with a red X indicating that there are some issues to review). Selecting the white flag and clicking the Open Action Center link displays the two major sections, Security, and Maintenance. Expanding the Security section displays the current health policy of Windows 7. By expanding the Maintenance section, we can take a look at the reliability history of the computer by clicking the Reliability Monitor link as shown on the next page in Figure 1.

The Reliability Monitor displays what has happened on your computer for a full calendar year since installation, in a day or week grid display. The displayed information is gathered and updated from event logs and event trace data due to a scheduled task executed by the Task Scheduler every hour. Tip: Take a look at what tasks are executing right now on your Windows 7 computer; open the Task Scheduler and review the Task Status display. The information displayed includes Application failures and Windows failures, in addition to Warnings and pertinent Information showing when drivers were last updated. The chart cannot be deleted by an end user.

After selecting a component from the chart, a summary of the reliability details is displayed; further details can be reviewed by clicking the link View all problem reports. Tip: From this location, we can drill down and view technical details from each report, finding out, for, example, what executable or DLL file is failing as shown in Figure 2.

Although device manager has been around since Windows 95, it's worth checking out the state of the installed hardware. Tip: Because the computer hardware is very highly integrated, after opening Device Manager from Control Panel, make sure to select the View menu and turn on Show Hidden Devices. This will show you a wealth of integrated software and hardware components that are normally not shown. Expanding the Non-PNP node also shows you motherboard devices that are not plug and play; potentially a system component could be faulty, and not be visible by default.

If you find that there is a red or yellow icon indicating a problem with an installed driver, open an elevated command prompt and type sigverif, to produce a report that will indicate what drivers are digitally signed. Tip: After reviewing the report, if there are unsigned drivers, take a moment to search the manufactures web site to see if an updated driver solves your driver problem.

Windows 7 also has an additional tool called Driver Verifier. Its job is to monitor kernel-mode drivers detecting incorrect function calls or other actions that might corrupt your Windows 7 system. Run Driver Verifier from an elevated command-prompt by typing Verifier. Reports can be generated providing details on the current state of the installed drivers, and also allow you to test IRQ and I/O settings as shown in Figure 3. Using this tool allows you to provide additional details to manufactures, or yourself, when drivers are the issue. More details can be found here: http://www.microsoft.com/whdc/devtools/tools/win7driverver.mspx

The System Configuration Utility (msconfig.exe) has been a part of Windows for several versions, and can be quite helpful when you want to diagnose or change your Windows 7 computer system's boot process.

The General Tab - This is where the boot process from normal mode into diagnostic, in effect forcing a Windows 7 system into a safe mode boot cycle. We also have the option of selected setup; as shown in Figure 3, this option allows you to specify whether you would like to load system services, load startup items from the registry, or modify the original boot configuration.

View the original article here

A New View on Windows

Q: In Windows 8, what is the relationship between desktop mode and the start-screen mode with the new user interface? I find it confusing that, when opening a picture, it goes to the picture app in the start screen instead of opening in the regular Windows photo viewer. The same goes for videos.

A: I believe Microsoft sees the tabletlike start screen experience in Windows 8 as the future of Windows, the beginning of a long transition away from the traditional Windows desktop. That's why Windows 8 opens in the start screen, why Microsoft is working to build up a large catalog of tablet-type apps that run only in the start screen, and why the traditional desktop has been relegated to a mode you reach by clicking on an icon on the start screen.

It's also why the default behavior in opening photos and videos is to use the new full-screen viewers in the start screen mode.

However, I'd point out that Windows 8 gives you a choice the first time you open a picture or video of switching to the traditional desktop viewers.

And, even if you haven't opted to do so, you can always right-click on a picture or video, choose "Open with" and use the traditional viewers.

Q: Should I un-pair my cellphone from my rental car's Bluetooth system when I'm done? Are there any data theft tracks I am leaving behind?

A. Every car-phone combination may be different, but in my experience, some cars can cache some information from the phone, including the address book and recent calls. It may be that rental cars don't do this, but even so, I'd definitely un-pair your phone from a rental car.

Q: At my office, I am given a choice between a Dell laptop and a MacBook Air. I've never run the Mac version of Microsoft Office and am a bit nervous about seamless compatibility with Windows versions of Excel, PowerPoint, and Word.

A: Years ago, compatibility between the Windows and Mac versions was spotty. But today, with the latest editions, it's very good. In most cases, a file created in Office on one platform will appear just fine in the other, and no conversion process is needed because both use the same file formats. However, there are exceptions. Some complex files created in Windows may not translate properly to the Mac.

— You can find Mossberg's Mailbox and my other columns at the All Things Digital website, http://walt.allthingsd.com. Email mossberg@wsj.com A version of this article appeared February 20, 2013, on page D2 in the U.S. edition of The Wall Street Journal, with the headline: Walter S. Mossberg answers readers' questions about technology.

View the original article here

Seven Security Myths of Windows 7

Network security is everyone's concern, and this applies to computer security as well. Many security breaches occur due to user ignorance of basic security principles, not malicious intent. Network and computer security are like an onion - there are multiple layers. Good security begins with understanding what you can do to keep your systems safe and implementing a layered approach. If you depend on one program or feature to secure your computer, then when (not if, but when) that dependency is breached, you may have personal information stolen or even have your computer taken over.

Not all versions of Windows 7 are created equal. This can be confusing to home users and small businesses that do not have an Active Directory domain. Many features that you have heard about when it comes to improved security are only found in the more expensive editions. In fact, only the Ultimate and Enterprise editions contain all of the security features. The Professional edition does have Group Policy controls and Encrypting File System (EFS), but does not include AppLocker or BitLocker. The Home Premium version does not even have the reduced security features found in the Professional Edition. In short, you will have to pay more if you want the more advanced security features, so be careful to purchase the edition of Windows 7 that meets your security requirements. There is not a "one-size-fits-all" version of Windows 7, and there definitely is not an a la carte edition.

This may also be seen as the Principle of Least Privilege. In this principle, users or processes must be able to access only the information and resources required for their specific roles. In this case, we are looking at applying the least-privileged user account (LUA). Many home users are also members of the local administrators group, giving them complete access to the system. In most corporate environments, this is not a safe security practice. Granting administrative access - even on a local computer - can lead to numerous security vulnerabilities. The User Account Control (UAC) component can limit changes being made to a computer that require administrator level permission. The UAC will notify a user if a change is attempted and if the user is an administrator, than the user can click Yes to continue. If the user is not an administrator, than someone with an administrator account on the computer will have to enter their password for the user to continue. Relying solely on the UAC to provide security for changes to your system is an invitation to disaster - especially when UAC is turned off completely.

Network administrators have Software Restriction Policies that can be implemented to control the behavior of software (what can or cannot run). AppLocker can extend the capabilities of Software Restriction policies. Now, an administrator can restrict or permit applications to run based on unique identities of files and to specify which users or groups can run these applications. With AppLocker, an administrator can control the type of applications that can run, which user or security group can run a program, create exceptions for programs, and even use PowerShell to control AppLocker. In short, AppLocker is a powerful utility for network administrators; it cannot replace a more comprehensive security model including a robust anti-virus program. Trojan programs can still be used to install malware on a system and users can be tricked into running other malware programs.

BitLocker Drive Encryption is a feature available on Windows7 Enterprise and Windows 7 Ultimate (another myth-conception of Windows 7). BitLocker and BitLocker To Go provide another layer of security to limit the potential loss of data through the loss or theft of a computer. BitLocker To Go can be used to protect USB flash drives as well as external hard drives. Not all computers can use BitLocker or BitLocker To Go. To use BitLocker, the hard disk on the computer must have two partitions, the operating system and active system partition must be formatted with NTFS, and the BIOS must support Trusted Platform Module (TPM) 1.2, though there is an exception. If the computer does not have a TPM of 1.2 or higher, you can use a USB drive to store the encryption keys. While this is an excellent method to secure your data, BitLocker or BitLocker To Go should be used in conjunction with other security methods to control access to your data.

There is always a secure, remote connection for Windows 7 users. Well, sort of. You would need to configure DirectAccess to provide for a secure automatic remote connection. DirectAccess allows users of Windows 7 Enterprise and Ultimate editions to make remote direct connections to a Windows Server 2008 R2 (as well as Windows 8 Server and beyond) server without having to use a VPN connection. Currently, users must use a VPN connection in order to make a secure remote connection.

View the original article here

Minimizing Windows 7 "Interface Shock"

Every desktop administrator worries about the potential disruption from a new user interface. Such a distraction has come to be known as "interface shock." Fortunately, it is possible to minimize interface shock for users by leveraging Group Policy to make Windows 7 look more like Windows XP. This white paper will help get you started, with a list of Group Policy settings that can make the Windows 7 landscape more familiar for XP users.

Every desktop administrator worries about the potential disruption from a new user interface. Such a distraction has come to be known as "interface shock." For those companies migrating from Windows XP to Windows 7, this is especially true. (Moving from Vista to Windows 7 can also involve some disorientation, but is markedly less dramatic.)

Microsoft believes that changes to the user experience are usually a good thing, making things easier, better, and faster. But as IT professionals, you and I know that sometimes that's true, and sometimes it isn't. For example, the breadcrumbs trail is intuitive and convenient, whereas the search feature is just the opposite.

Many organizations want to take advantage of the speed, security, reliability, and flexibility of Windows 7, while minimizing the disruption to users and support staff due to features and changes you don't need or won't use. For example, they might want to make Windows 7 look more like XP in order to ease the transition, and then turn on aspects of the Windows 7 GUI later, after the initial migration is complete.

Fortunately, it is possible to minimize interface shock for users by leveraging Group Policy to make Windows 7 look more like Windows XP. This white paper will help get you started, with a list of Group Policy settings that can make the Windows 7 landscape more familiar for XP users. The settings are grouped as follows:

Disabling new programs
Disabling new features
Bringing back familiar elements

This paper focuses on making changes with Group Policy, for example via the Group Policy Management Console (see Figure 1). The great thing about Group Policy is that you can enforce settings on a per-organizational-unit basis, so that if the settings we discuss here are appropriate for some subsets of your user population but not others, you can design your Group Policy Object links accordingly. (You can also link GPOs to domains and sites.) And if the intended scope of your Group Policy settings doesn't line up nicely with the way your Organizational Units or domains or sites are designed, you can always fall back on using filtering by security groups. (That can be a moderately complex topic that won't be covered here, but do an Internet search on "security group filtering" to learn more.) For more details on Longhorn Group Policy capabilities, check out the Windows Group Policy Resource Kit, by Derek Melber. It's written for Server 2008 and Vista, but most of the policy settings are the same for Windows 7.

When you use the Group Policy Management Console as a jumping-off point for editing a GPO, you will be working within the multi-level hierarchy of the GPO architecture (see Figure 2). The hierarchy exposed by this tool is both daunting and inconsistent, so when I mention a setting in this white paper, I also provide its location in the hierarchy. Some settings appear in the "User Configuration" half, some in the "Computer Configuration" half, and some both places, indicating whether the setting will apply based on the location of the computer object in Active Directory (in which case it will affect all users who log on to that machine), or the user object.

Windows 7 brings some welcome enhancements to applets such as WordPad, Paint, and Calculator. However, it also introduces a number of new tools that you may or may not want. Some of the new programs in Windows 7 can be disabled so that users won't accidentally try to use them, get confused or frustrated, and call the Help Desk. Here are a few candidates to consider.

Windows Backup. Many organizations have their own preferred backup software for servers and clients. Also, many organizations don't bother backing up clients at all, particularly if they use folder redirection for the Documents folder, or mandate storing all data files on network shares.

"Prevent the user from running the Backup Status and Configuration Program" (Location: User Configuration\Policies\Administrative Templates\Windows Components\Backup\Client)

BitLocker and BitLocker-To-Go. BitLocker is a secure full-volume encryption technology that weds your hard drive to a Trusted Platform Module (TPM) chip on your motherboard, and BitLocker-To-Go extends encryption to removable devices such as flash drives. These encryption features are available in the Enterprise and Ultimate versions of Windows 7. However, they can create problems if your organization is not prepared to support them: for example, a user who "BitLockers" his hard drive may find that his PC is completely inaccessible after a motherboard repair. Also, you may be using an alternative encryption technology for portable devices such as flash drives. Happily, you can disable BitLocker-To-Go via Group Policy.

View the original article here

Twelve Fantastic Features You Need to Know about Windows Server 2012

Windows Server 2012 is Microsoft's latest upgrade to their workhorse server platform and the changes and upgrades are significant. From an industry-leading hypervisor, superior management capabilities and more flexible and resilient storage, Server 2012 will help lead the way into the next decade of Microsoft technologies. Read on to learn more about this key technology foundation and how it will simplify and improve delivery of your organization's IT services.

The latest, and perhaps the most significant version of Windows Server was released in September 2012. What makes this release so significant is not just the new interface and default installation, but the enhanced Windows PowerShell, support for new hardware (which means increased performance, reliability, scalability, security, and storage options). The new virtualization enhancements have greatly increased not only the scalability of Hyper-V but performance and enterprise adoptability as well. In short, Windows Server 2012 helps you transform your IT operations to reduce costs and deliver a whole new level of business value has hundreds of new features and enhancements spanning networking, storage, user experience, cloud computing, and more.

PowerShell is a command-line scripting language used for administration and management of Windows Server 2012 (as well as other products such as Exchange, Lync, SharePoint, SQL, and System Center). PowerShell enables IT professionals to control, automate, and perform bulk administration of Windows operating system and applications that run on Windows. Windows PowerShell 3.0 is backwards-compatible with PowerShell 2.0 and its associated cmdlets. Some of the new windows features in PowerShell include:

Disconnected Sessions. These are user-managed, persistent sessions (PSSessions) that are created by using the New-PSSession cmdlet. The PSSessions are saved on the remote computer and are no long dependent on the session in which they were created.

Module Auto-Loading. All functions and modules that are installed on the computer will be loaded even if the module is not imported into the current session.

PowerShell ISE. Features include auto-save, block copy, brace-matching, Intellisense, recent items list, Showcommand window, support for writing Windows PowerShell script workflows, and a unified Console Pane.

Updatable Help System. You can use the Update-Help cmdlet to identify, download, unpack ad validate new help files from the internet.

Windows PowerShell Workflow. Windows PowerShell workflows are sequences of administrative or management actions that can be applied against multiple computers. These actions can be frequent, long-running, repeatable and uninterruptible. Users and administrators can write workflows in XAML.

Windows PowerShell Web Access. Administrators and users can run PowerShell commands and scripts in a web-based console.

Hyper-V (or Hypervisor) enables you to create a virtualized server computing environment. Virtualization with Hyper-V enables you to improve the efficiency of your computing resources by utilizing more of your hardware resources. Hyper-V was first released with Server 2008 and has seen substantial improvements ever since. Windows Server 2012 introduces several new and greatly enhanced features that puts in on par with the best hypervisors available.

Hyper-V on Windows
Server 2012

Hyper-V on Windows
Server 2008 R2

Active Virtual Guests per host

Virtual CPUs per virtual guest session

Maximum number of nodes in a cluster

Table 1. Scalability in Windows Server 2012 Hyper-V

Hyper-V Replica provides asynchronous replication of virtual machines (VMs) from a Hyper-V host or cluster to a remote Hyper-V host or cluster to provide business continuity and fail-over recovery. This new, built-in feature tracks write operations on the source Host or cluster and replicates them to the destination host or cluster so that both VMs are in constant lockstep. If the local VM fails (or if an administrator manually fails-over) the remote replica assumes its place. All of this happens without having any specialized storage or networking hardware requirements.

VHDX Disk. The VHDX disk format is new to Hyper-V 3 and adds new capabilities and enhancements over previous versions:

A VHDX virtual hard disk can be as large as 64 TB.
Support for larger block sizes in VHDX virtual disks. This provides support for dynamic and differential disks, which in turn, allows for lets these disks attune to the needs of the workload.
A 4-KB logical sector virtual disk for applications and workloads that support 4KB sectors.
Conversion from a VHD to VHDX and back.

Live Migration is now built into Windows Server 2012 (whereas before, you only had this capability when you used System Center Virtual Machine Manager with Quick Storage Migration). Live Migration in Windows Server 2012 enables an administrator to migrate live VMs between stand-alone Hyper-V 3 hosts without requiring the use of any shared storage. The benefit of this is that the VMs can be moved while keeping the VMs online and available to clients, thus ensuring no downtime. You can perform a live migration through a GUI interface or through a PowerShell cmdlet.

View the original article here